In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK> The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough. Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992961 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

    There is a global-out-of-bounds reported by KASAN:

      BUG: KASAN: global-out-of-bounds in
      _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]       Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411

      CPU: 6 PID: 411 Comm: NetworkManager Tainted: G      D       6.1.0-rc8+ #144 e15588508517267d37       Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),       Call Trace:
       <TASK>        ...
       kasan_report+0xbb/0x1c0
       _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]        rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]        rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]        ...
       </TASK>

    The root cause of the problem is that the comparison order of     prate_section in _rtl8812ae_phy_set_txpower_limit() is wrong. The
    _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two     strings from tail to head, which causes the problem. In the
    _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet     this requirement by carefully designing the comparison order.
    For example, pregulation and pbandwidth are compared in order of     length from small to large, first is 3 and last is 4. However, the     comparison order of prate_section dose not obey such order requirement,     therefore when prate_section is HT, when comparing from tail to head,     it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As     mentioned above, the _rtl8812ae_eq_n_byte() has the same function as     strcmp(), so just strcmp() is enough.

    Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
    Although it can be fixed by adjusting the comparison order of     prate_section, this may cause the value of rate_section to not be     from 0 to 5. In addition, commit 21e4b0726dc6 not only moved driver     from staging to regular tree, but also added setting txpower limit     function during the driver config phase, so the problem was introduced     by this commit.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992184 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

    There is a global-out-of-bounds reported by KASAN:

      BUG: KASAN: global-out-of-bounds in
      _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]       Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411

      CPU: 6 PID: 411 Comm: NetworkManager Tainted: G      D       6.1.0-rc8+ #144 e15588508517267d37       Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),       Call Trace:
       <TASK>        ...
       kasan_report+0xbb/0x1c0
       _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]        rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]        rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]        ...
       </TASK>

    The root cause of the problem is that the comparison order of     prate_section in _rtl8812ae_phy_set_txpower_limit() is wrong. The
    _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two     strings from tail to head, which causes the problem. In the
    _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet     this requirement by carefully designing the comparison order.
    For example, pregulation and pbandwidth are compared in order of     length from small to large, first is 3 and last is 4. However, the     comparison order of prate_section dose not obey such order requirement,     therefore when prate_section is HT, when comparing from tail to head,     it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As     mentioned above, the _rtl8812ae_eq_n_byte() has the same function as     strcmp(), so just strcmp() is enough.

    Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
    Although it can be fixed by adjusting the comparison order of     prate_section, this may cause the value of rate_section to not be     from 0 to 5. In addition, commit 21e4b0726dc6 not only moved driver     from staging to regular tree, but also added setting txpower limit     function during the driver config phase, so the problem was introduced     by this commit.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992349 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

    There is a global-out-of-bounds reported by KASAN:

      BUG: KASAN: global-out-of-bounds in
      _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]       Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411

      CPU: 6 PID: 411 Comm: NetworkManager Tainted: G      D       6.1.0-rc8+ #144 e15588508517267d37       Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),       Call Trace:
       <TASK>        ...
       kasan_report+0xbb/0x1c0
       _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]        rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]        rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]        ...
       </TASK>

    The root cause of the problem is that the comparison order of     prate_section in _rtl8812ae_phy_set_txpower_limit() is wrong. The
    _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two     strings from tail to head, which causes the problem. In the
    _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet     this requirement by carefully designing the comparison order.
    For example, pregulation and pbandwidth are compared in order of     length from small to large, first is 3 and last is 4. However, the     comparison order of prate_section dose not obey such order requirement,     therefore when prate_section is HT, when comparing from tail to head,     it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As     mentioned above, the _rtl8812ae_eq_n_byte() has the same function as     strcmp(), so just strcmp() is enough.

    Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
    Although it can be fixed by adjusting the comparison order of     prate_section, this may cause the value of rate_section to not be     from 0 to 5. In addition, commit 21e4b0726dc6 not only moved driver     from staging to regular tree, but also added setting txpower limit     function during the driver config phase, so the problem was introduced     by this commit.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03628-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37885: KVM: x86: Reset IRTE to host control if *new* route isn't postable (bsc#1242960).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245498).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38470: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime     (bsc#1247288).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39797: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (bsc#1249608).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03615-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
    - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
    - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
    - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
    - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
    - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869).
    - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
    - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
    - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666).
    - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028).
    - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
    - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree     (bsc#1248255).
    - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
    - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
    - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
    - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
    - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
    - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195).
    - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
    - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).
    - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
    - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
    - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266).
    - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
    - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
    - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548).
    - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
    - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007).
    - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247).
    - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() There is a global-out-     of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84     [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm:
    NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 +     ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84     [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0     [rtl8821ae] ... </TASK> The root cause of the problem is that the comparison order of prate_section in
    _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n     bytes of the two strings from tail to head, which causes the problem. In the
    _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully     designing the comparison order. For example, pregulation and pbandwidth are compared in order of     length from small to large, first is 3 and last is 4. However, the comparison order of prate_section     dose not obey such order requirement, therefore when prate_section is HT, when comparing from tail to     head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the
    _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough. Fix it by removing
    _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order     of prate_section, this may cause the value of rate_section to not be from 0 to 5. In addition, commit     21e4b0726dc6 not only moved driver from staging to regular tree, but also added setting txpower limit     function during the driver config phase, so the problem was introduced by this commit. (CVE-2022-50279)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
281372	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992961)	Nessus	Unity Linux Local Security Checks	high
280447	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992184)	Nessus	Unity Linux Local Security Checks	high
280223	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992349)	Nessus	Unity Linux Local Security Checks	high
270857	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03628-1)	Nessus	SuSE Local Security Checks	high
270837	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:03615-1)	Nessus	SuSE Local Security Checks	high
264917	Linux Distros Unpatched Vulnerability : CVE-2022-50279	Nessus	Misc.	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2022-50279

high

Tenable Plugins

high

high

high

high

high

high

high